How can CVE-2021-3062 be exploited?

Exploiting CVE-2021-3062 allows an attacker to perform unauthorized actions, such as accessing sensitive information or executing arbitrary commands, on the affected VM-Series firewalls.

Which versions of Paloalto Networks PAN-OS software are affected by CVE-2021-3062?

Paloalto Networks PAN-OS software versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.11, and 10.0.0 to 10.0.8 are affected by CVE-2021-3062.

What is the severity of CVE-2021-3062?

CVE-2021-3062 has a severity score of 8.8 (high).

How can I mitigate the CVE-2021-3062 vulnerability?

To mitigate CVE-2021-3062, Paloalto Networks recommends upgrading to a fixed PAN-OS software version.

Vulnerability/
CVE-2021-3062

high

8.8

CWE

284

10/11/2021

25/7/2022

CVE-2021-3062

Q: What is CVE-2021-3062?

CVE-2021-3062 is an improper access control vulnerability in PAN-OS software that allows an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS.

First published: Wed Nov 10 2021(Updated: )

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

Credit: psirt@paloaltonetworks.com

Affected Software	Affected Version	How to fix
Paloaltonetworks Pan-os	>=8.1.0<8.1.20
Paloaltonetworks Pan-os	>=9.0.0<9.0.14
Paloaltonetworks Pan-os	>=9.1.0<9.1.11
Paloaltonetworks Pan-os	>=10.0.0<10.0.8
Paloaltonetworks Vm-series Firewall

Never miss a vulnerability like this again

Reference Links

https://security.paloaltonetworks.com/CVE-2021-3062

Frequently Asked Questions

What is CVE-2021-3062?
CVE-2021-3062 is an improper access control vulnerability in PAN-OS software that allows an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS.
How can CVE-2021-3062 be exploited?
Exploiting CVE-2021-3062 allows an attacker to perform unauthorized actions, such as accessing sensitive information or executing arbitrary commands, on the affected VM-Series firewalls.
Which versions of Paloalto Networks PAN-OS software are affected by CVE-2021-3062?
Paloalto Networks PAN-OS software versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.11, and 10.0.0 to 10.0.8 are affected by CVE-2021-3062.
What is the severity of CVE-2021-3062?
CVE-2021-3062 has a severity score of 8.8 (high).
How can I mitigate the CVE-2021-3062 vulnerability?
To mitigate CVE-2021-3062, Paloalto Networks recommends upgrading to a fixed PAN-OS software version.

collector/nvd-index
agent/type
vendor/paloaltonetworks
canonical/paloaltonetworks pan-os
version/paloaltonetworks pan-os/8.1.0
version/paloaltonetworks pan-os/9.0.0
version/paloaltonetworks pan-os/9.1.0
version/paloaltonetworks pan-os/10.0.0
canonical/paloaltonetworks vm-series firewall

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.